Fuzzy fault trees

In Chapter 2, we described an approach to fault tree logic that used an assessed probability of an event taking place. Strict interpretation of fault trees does not assign that probability of an event as in analysis; it is either pass or fail for a fault.³ The method illustrated used probabilities to provide an assessment of the likelihood of an occurrence. A further adaptation of that method uses fuzzy logic that can also be applied to FTA, where instead of a fixed probability being assigned (in strict FTA, the probability is either 100% true or false), a range of probabilities can be applied to each element. For example, if a particular event has between a 20 and 60% likelihood of occurrence (or any other percentage between 0 and 100%), the event could be considered probable, and the fault would be conducted to the next layer of the system for further analysis. This analysis allows us to better estimate risk in an uncertain environment.⁴ The use of fuzzy logic is an improvement over the conventional “on-or-off” logic implicit in an FTA, and it uses the same analysis techniques described in Chapter 2, with the exception that it involves a lot more computation, because for each event multiple calculations are required as one steps through the calculations.

For example, if the probability for one event is between 0.2 and 0.6 (20 and 60% likely), one might have to repeat the entire set of calculations for the entire fault tree at stepped intervals—say 0.2, 0.22, 0.24,…,0.58, 0.58, and 0.60. The process would be repeated with appropriate variables on the next element. This is where computers are extremely useful in reducing repetitive and tedious calculations.

Markov chains and Bayesian analysis

Other effective ways of evaluating the likelihood of probabilities for success or failure of an attack, especially where we do not have data, are to perform a Bayesian network analysis or a Markov chain analysis. These types of analyses can be constructed considering upon the failure or reliability of various subcomponents of the plant. In these types of analysis, it is often useful to diagram a risk tree, with the probabilities for each option. In a Markov chain, each state is treated as a variable, and matrix methods are employed to describe the risk.⁵ The computations on a Markov chain can become quite complex and large, and computer methods are used to develop a risk calculation.⁶ However, if a category or type of risk is not addressed, it is unknown.

The Bayesian network analysis is one of the most powerful analytical tools, as it determines not only direct probabilities but also examines and projects the posterior probabilities based upon the existing data. The changes in any one subcomponent of the plant can then be examined to determine the impact, likelihood of success, or failure on other components of the plan data and model. This technique is extremely powerful but requires a working knowledge of statistics, and it is computationally intensive as well.

The technique may be too sophisticated for many companies, because the most difficult task in a Bayesian analysis is the establishment of the initial condition tables to make sure that they reflect the appropriate values and relationships. The network is then examined to insure that there are no conditional faults and the data are fed into a computer to produce the probabilities. This method is computationally similar to the Markov chain analysis.

There are several very good Bayesian network programs and texts⁷ as cited in the section “Notes”. The assumptions and the setup of the risk decision tables are key to the analytical technique. AgenaRisk is a good program that is free with the purchase of the textbook Risk Assessment and Decision Analysis with Bayesian Networks, by Fenton and Neil (CRC Press). Other programs include Netica (a few hundred dollars from www.norsys.com); GeNIe & Smile is freeware from the University of Pittsburgh (www.genie.sis.pitt.edu), and SamIam (freeware from http://reasoning.cs.ucla.edu/samiam/) is also worth considering.

Fishbone (Ishikawa) diagrams

Two of the easiest to use and understand FMEAs are the fishbone diagram (ISHIKAWA diagram) and the Pareto chart. The fishbone diagram should be applied where you are attempting to identify possible causes for a problem or possible methods of attack or interference. The fishbone diagram tends to help avoid falling into ruts by the organization of the diagram. A sample fishbone diagram is shown below—prepared using the free software and guidance from http://www.fishbonediagram.org/template. The website also has a fishbone diagram template for PowerPoint slides. Both are free for downloading. We have followed the basic suggestions for fishbone diagrams and have considered the elements of man power, methods, machines, metrics, materials, and minutes (time) in the diagram below.

In preparing a fishbone diagram, it is important to use a team approach and group and identify possible causes. When possible causes have been identified, group them under representative headings, and then list the individual cases on each group. No idea is too unimportant to consider, and when the diagram is completed and the causes are identified, then review the diagram and highlight the most important causes.

Example

The example above is for security failure at a chemical plant that caused a successful attack on a motor control center and an operation control station (Fig. 7.1). The attackers came into the plant through a remote corner of the fence near the tank farm. They were able to be unobserved for what is estimated as an hour. In that time, they managed to enter an unlocked door in a motor control room and dump nails and sand into motor vents and into oil receptacles causing a number of large motors to burn out. They also compromised an unattended operator’s control station, shutting down some safety interlocks and turning on pumps that they had sabotaged. The result was several tens of thousands of dollars in direct repair, plus many times that in lost production.

In the analysis, manpower, metrics, methods, machines, time (minutes), and materials are categories for failures of the security system.

In each case, the question of “Why does this happen?” must be answered. Subcauses, if any, are shown as branches of the principal element categories.

A different type of analysis for a plant attack might include the basic question of “How is the plant attacked?” The principal ribs of the fishbone could be environment, weapons, communications, cyber, transportation, storage, raw materials, supervisory controls, laboratory, and pipelines. Subcategories might include such items under raw materials: bomb in shipment, deliberate contamination of feedstock, receiving accidents, storage accidents, etc. The point is to be as thorough as possible and examine each possible method or means until the chart is complete. In some instances, more than one chart may be required for complete analyses.⁸ The ASQ website also has a free download Excel© spreadsheet with the detailed Ishikawa or fishbone diagram.

Pareto charts

A Pareto chart is a different type of analysis and may be useful in analysis of the number and type of security faults occurring at a facility. If, for example, a number of security and/or safety violation incidents occurred, one would have to categorize them with respect to the type. Each type has to have a common measure over a definite period of time, such as frequency. Categories may be something like fence false alarms, sensor failures, camera failures, personnel incidents, etc. The results are converted to a bar chart with the item with the greatest frequency on the left, and the others arranged in decreasing order. A sample Pareto bar chart is shown in Figure 7.2.

Example

In the figure above, let us assume that there is a large tank of petroleum (flammable) material, and a tank of highly odorous trimethyl amine nearby. The consequences from a petroleum leak (threat A) would be fire, smoke, vapor cloud, and possibly community evacuation. Trimethyl amine is a highly odorous compound that smells like dead fish.

The nose can detect concentrations of TMA as low as 0.267 mg/m³ in air, and the compound has a high vapor pressure (1189 mm Hg@ 15°C, while water is 187.5 mm Hg@ 15°C) and will evaporate out of water, and it has a recommended exposure limit (8 hours TWA between 10 and 15 mg/m³), such that it will outgas from water. A release of the material can be both irritating and hazardous to the health of the community.¹² A release should be avoided at almost all costs.

Top-level undesired consequences are:

1. Community evacuation
2. Fire
3. Explosion
4. Community exposure to chemicals

Threat scenario A is a leak in a petroleum tank.

Threat scenario B is a leak in any part of the TMA plant.

• Control measures for A:
  • Continuous inspection of tanks and piping
  • Periodic pressure testing of lines
  • Periodic maintenance of seals and pumps
  • Electrical grounding of all hoses and piping
  • Fire foam for dikes around the tank
• Control measures for B:
  • Periodic inspection and testing of all valves and joints with electronic sniffers to detect leaks
  • Use of welded steel pipes, minimizing flanges
  • Regular maintenance
  • Grounding of all piping
  • Periodic replacement of pump seals
  • Enclose plant within a structure
  • Use of acid scrubber for gases from the building to reduce TMA
• Recovery measures for A:
  • Diking for spill control
  • Vapor blanketing for diked area
  • Spill control drills
  • Rapid response for cleanup
  • Firefighting measures
• Recovery measures for B:
  • Community evacuation
  • Shelter in place
  • Acid water spray to attempt to knock down vapor cloud
• Potential consequences for A:
  • Fire
  • Underground contamination that needs to be cleaned up
  • Expensive spill cleanup
  • Loss of product
• Potential consequences for B:
  • Adverse long-term health effects
  • Bad community relations
  • Expensive decontamination of residences and properties

Process safety information: General

Employers must complete a compilation of written process safety information before conducting any PHA required by the standard. The compilation of written process safety information, completed under the same schedule required for process hazard analyses, will help the employer and the employees involved in operating the process to identify and understand the hazards posed by those processes involving highly hazardous chemicals. Process safety information must include information on the hazards of the highly hazardous chemicals used or produced by the process, information on the technology of the process, and information on the equipment in the process.

The approach here is to indicate the relative information for planning processes as it may relate to physical security of the plant. In the master file of the plant, available to plant security and to select management teams in the security force, the following information should be included in the emergency and security plans at the plant, where appropriate. The purpose is to provide enough information for emergency responders and guards to facilitate evacuations and/or work safely when there may be an incident in the plant.

In that regard, a planning tool such as ALOHA¹⁵ is excellent for planning purposes because it permits the evaluation of the on and off plant effects of accidental chemical releases.

PHA and HAZOPS

The PHA and HAZOPS are a process that is applicable to the process and manufacturing industries. It is primarily designed as a safety analysis tool for plant operations. There are several different ways of performing PHA process as it may apply to plant security. The applicable methods include a review of a detailed checklist prepared with regard to the process and a comprehensive analysis of the modes of failure and restoration: a “what-if” analysis that reviews the plant processes literally pipe by pipe and process, looking for methods of what can happen and/or go wrong.

For the security professional, PHA and HAZOPS have some of the same elements but with a slightly different focus. We will designate this by the SPHA.

A SPHA study identifies hazards and operability problems by identifying how the plant security system might deviate from the design intent. If a solution to a problem becomes apparent, it is recorded as part of the SPHA result, but the prime objective for the SPHA is problem identification.

SPHA studies are normally conducted during the design phase, especially when new technology or process are involved as part of the larger PHA in the plant, but can be used at almost any phase of a plant’s or security system’s life.

The PHA and SPHA is based on the principle that several experts with different backgrounds can interact and identify more problems when working together than when working separately and then combining their results. The most common form of HAZOPS study employs guide words to test the consequences of parameters deviating from design.

The objectives of an SPHA study may include as follows: (i) check the safety of a design or perimeter or remote location; (ii) check the maintainability and operability of a design or configuration and equipment; (iii) decide whether and where to build additional security measures or improvements; (iv) develop a list of questions to ask a supplier of equipment; (v) check operating and safety procedures, and test the security of an operation or part of the plant.

Additional purposes may include improvement of the safety of an existing facility through examining various elements of the security, fire, health, safety, and other divisions and their coordinated functioning in time of a plant-wide incident and verification that security instrumentation is reacting to optimum parameters and has minimized interferences.

Generic Guideline for the Calculation of Risk Inherent in the Carriage of Dangerous Goods by Rail

This guideline and as such it includes a discussion of the movement of dangerous goods by rail, and it has a good discussion on the subject of risk assessment of rail movement and accident rates for transportation incidents.

The Orange Book: Management of Risk—Principles and Concepts

The Orange Book is accurately titled with regard to its contents. It is relatively short weighing in at 52 pages, but it discusses all of the major concepts involved in risk management, although not in the detail covered in this book. The book is published by the Royal Treasury in the United Kingdom and is available for free download: https://www.gov.uk/government/publications/orange-book.

The opening lines of the Orange Book recommend that it be read in conjunction with the Green Book (which will be discussed in following paragraphs). The Orange Book lays out the general principles of risk management and has several unique observations:

• “The management of risk is not a linear process; rather it is the balancing of a number of interwoven elements which have to be in balance with each other if risk management is to be effective. Furthermore, specific risks cannot be addressed in isolation from each other; the management of one risk may have an impact on another, or management actions which are effective in controlling more than one risk simultaneously may be achievable.”
• “There is no single right way to document an organization’s risk profile, but documentation is critical to effective management of risk.”
• There are two different phases of risk identification:
  • Initial risk identification (for an organization that has not previously identified its risks in a structured way, or for a new organization, or perhaps for a new project or activity within an organization).
  • Continuous risk identification is necessary to identify new risks that did not previously arise, changes in existing risks, or risks that did exist ceasing to be relevant to the organization (this should be a routine element of the conduct of business).
• Risks should be related to objectives.
• “Individual risks which an organization identifies will not be independent of each other; rather they will typically for natural groupings…. It is important not to confuse the grouping of risks with the risks themselves…. All risks once identified, should be assigned to an owner who has responsibility for ensuring that the risk is managed and monitored over time.”
• Important risk assessment principles include:
  • Insuring that a clearly structured process identifies both the likelihood and the impact for each considered risk
  • Recording and documenting risk considerations in a manner that can facilitate identification and monitoring of the risk priorities
  • Clarity in describing the difference between inherent and residual risk¹⁷
• Risk management can be dealt with by (i) toleration, (ii) treatment, (iii) transferring, or (iv) termination of the risk elements.
• Recommendations include monitoring of the risk profile, performing risk review annually, and making provisions to alert management to changing (increasing) levels of risk.
• Much of the risk assessment is focused on financial risk (where it needs to be), but the principles are primarily relating to those dealing with accounting practices, and the document relies on Risk Management Guidance and the Mullarkey Report (2003) on risk assessment that is generally unavailable because it has been institutionalized.
• A copy of parts of the Mullarkey Report is available from the Government of Ireland, Government Accounting Section, Department of Finance, March 2004, Risk Management Guidance for Government Department and Offices.
• The guidance document cited in the preceding paragraph uses a risk register, which is a guidance document summarizing risk including categories for a brief description of the risk item; the division to which it is assigned; the policy or strategy number; a numeric ranking for likelihood, impact, and control effectiveness; a rating number that is obtained by multiplying the three rankings together; a brief statement of consequences; measures to address; additional actions; and finally the owner of the issue (person responsible for minimizing the risk). In short, it similar to the type of table used in a bow-tie analysis that is pinned to a division and an owner of the risk.
• One other document used in the United Kingdom is the HM Treasury Risk Management Assessment Framework: A Tool for Departments (July 2009). The document takes a slightly different approach to the Mullarkey principles but provides a comprehensive and thorough discussion for review.

The Green Book: Methods for the Determination of Possible Damage to People and Objects Resulting from Release of Hazardous Materials, CPR-16E

This document has seven chapters in 337 pages. The chapters address (1) damage caused by heat radiation, (2) the consequences of explosion effects on structures, (3) the consequences of explosion effects on humans, (4) survey study of the products that can be released during a fire, (5) damage caused by acute intoxication, (6) protection against toxic substances by remaining indoors, and (7) population data.

Chapter 1 of the Green Book deals with the effects of heat radiation and has useful curves and data and formulas on burn/exposure data for exposed skin and clothing ignition from various sources. The first chapter on radiation damage also considers the radiation values for ignition of building materials, softening steel members, and the formulas for the evaluation of these cases.

The limiting value for third-degree burns varies between 125 and 140 kJ/m², for durations of 1–35 seconds. For second-degree burns, the minimum value is between 30 kJ/m² at about 3 seconds and about 75 kJ/m² at 30 seconds for guidance. The formula for determining the degree of burn based on a heat exposure and time is complex and involves error function curves and higher mathematics. There is also a good discussion on pool fires and fireball (BLEVE) explosions. As such, it is useful for planning purposes but extremely complex and perhaps unusable in an emergency situation without substantial evaluation and applications.

Chapters 2 and 3 of the Green Book deal with blast effects and loadings, are excellent, and have many useful tables and graphs on the calculation of blast effects on a building and upon humans. There is also a substantial section on the extremely complex subject of the building response to blast and shock loadings. The analysis is quite detailed on the subject of natural periodicity of buildings in response to shock loadings.

There is also a section on the empirical data of blast loadings and effects: on buildings, pressure loadings on the order of the following will create significant damage.

There is also a useful gauge that compares the relative damage levels and difference between English- and US-built homes, where the English homes are generally brick built, and it generally follows the information outlined immediately above, but it is interesting to observe that comparable low level pressure events on US-style homes appear to cause less damage than in brick-built homes. This is believed due to the difference in building materials where US homes tend to use more wood. The appendices to the chapter on the effects of explosions on buildings contain a number of good models for additional mathematical analysis.

Chapter 3 of the Green Book principally deals with the effects of blasts on human populations, including the effects of explosions and flying debris such as glass on the body and on the skin. Part of the chapter deals with the crushing of organs and lungs due to the explosive force and internal damage of people in the vicinity of an explosion. Overall, the material is quite detailed and quite useful.

Chapter 4 of the Green Book concerns itself with the effects of damage caused by combustion products and particularly those that have organics and chlorine compounds. As such, there is a good bit of information on the formulation of combustion products that result in the formation of polychlordibenzo-p-dioxins and other polychlorinated compounds. The information on combustion by-products is both useful and timely with regard to planning for any incidents.

Chapter 5 of the Green Book deals with the effects of acute intoxication. But the title is misleading. The chapter does not deal with alcoholism but deals with inhalation of toxic substances. As such, it provides an excellent guide to the subject of inhalation. It is not as comprehensive as the NIOSH Pocket Guide to Hazardous Chemicals, but it is good.¹⁸ The personal preference is for the NIOSH guide because it is both available on PDF and is designed for handheld computers.

Chapter 6 of the Green Book discusses the protection against toxic substances by remaining indoors. The relative effect of protection is dependent upon a number of factors, including wind speed, concentration in the toxics cloud, insulation of the building, ventilation rate of the structure, absorption of the hazardous materials, particle or molecule size, and other factors. It cites the idea that most residential structures have a ventilation rate of 0–0.5^−h so that the protection factor can be preliminarily assessed as equal to 2.0 for a hazardous emission duration of 1 hour or less. The detailed information is presented in a form that will enable the sheltering capabilities of residences and structures. While this information is useful in the planning stage, it may be too complex to use in an emergency response situation, and much of the information is covered in the ALOHA program. The chapter does contain a series of very good graphs indicating concentration reduction curves from a temporary source with relative ventilation rates for residential and other buildings and tables that allow one to calculate their relative protection factors from various types of releases.

Chapter 7 of the Green Book presents planning data on population densities. The information is useful, but a cautionary note should be sounded with regard to different densities in various countries. In the United States and Canada, land use planning data are available, and they may provide a more accurate guide for the existing populations in the vicinity of a plant or facility. The data in Chapter 7 is excellent but of necessity in general. Land use planning data from various governmental agencies may provide more accurate pictures of local population densities and is certain to provide a more recent picture that is influenced by regional differences.

The Yellow Book: Methods for the Calculation of Physical Effects due to the Releases of Hazardous Materials (Liquids and Gases), CPR-14E

This book is massive at 870 pages but fortunately available in PDF. The opening paragraph in user instructions sets the tone for the book:

The educational design provides a framework according to which this version of the Yellow Book has been structured…the Yellow Book starts with a section on outflow and spray release (Chapter 2), then addresses evaporation (Chapter 3) and dispersion (Chapter 4), before addressing several other specific aspects, such as vapor cloud explosion (Chapter 5), heat load (Chapter 6), and rupture of vessels (Chapter 7). Finally a section on interfacing related models (Chapter 8) illustrates how to proceed in applying a sequence of models in estimating physical effects according to a few selected scenarios.

The Yellow Book goes into numerical modeling of various types of releases, including sprays and vapors, and has advice on the topics of dense gas modeling and modeling evaporation from a pool and a pool fire. It is the type of book that a chemical engineer uses to calculate mathematical effects, and one needs a sound foundation in heat transfer, thermodynamics, engineering, and some familiarity with atmospheric dispersion modeling in order to use this book properly. It is literally overwhelming in the amount of details provided and required to create models of the various types of releases. Of particular interest is Chapter 7, which deals with tank ruptures and blasts. This chapter also addresses the subject of blast projectiles and tank fragments that might be released during a tank rupture scenario.

The Red Book: Methods for Determining and Processing Probabilities, CPR-12

This is really a book about applied statistics and risk assessment. As such, it covers many of the topics addressed in this book but in significantly greater mathematical detail. It addresses topics such as mean time between failures (MTBF), FTA and event tree analysis, Markov chains, accident sequence development and quantification, as well as detailed discussions on statistics and computation and reliability theory. Of particular interest are Chapters 16 and 17, which deal with reliability availability maintenance and reliability-centered maintenance, with practical guides to establishing the mathematical basis for the programs and suggestions for establishing tenders for the program if conducted by outsiders. Overall, the book is excellent and informative.

The Purple Book: Guidelines for Quantitative Risk Assessment, PGS 3

Special note: Many industries may encounter problems in applying the quantitative risk assessment procedures because the focus of the assessments ultimately is in fatalities per year. (This is often referred to as the probit function.) From a liability standpoint, US-based corporate executive would not consider designing or evaluating a system in terms of the number of deaths per year because the aggressive legal culture in the United States would indict him and his company on criminal negligence charges.

The analysis of the Purple Book is a bit more comprehensive than the other colored books because of its relevance to the overall topics of security. The approach taken in the Purple Book is slightly different from the standpoint of risk assessment. Performing a quantitative risk assessment is a lot of work and requires detailed analysis of the entire facility, and it could require several hundred to several thousand man-hours of effort. The EUECE and the UK Competent Authority (Health and Safety Executive in the United Kingdom) have developed a screening test to determine whether or not a specific facility would require a comprehensive QRA.

The need for the QRA is based on a screening value S derived by computing the boundary distances between the operating portions of the plant and the plant fence line. The guideline values are determined by the following set of calculations.

First, criteria are set for excluding substances from the risk assessment guidelines to reduce the potentially large number of sites:

1. Physical form of the substance

   Substances in solid form such that under both normal conditions and any abnormal conditions that can be reasonably foreseen, a release of matter or of energy, which could create a major accident hazard, is not possible

2. Containment and quantities

   Substances packaged or contained in such a fashion and in such quantities that the maximum release possible under any circumstances cannot create a major accident hazard

3. Location and quantities

   Substances present in such quantities and at such distances from other dangerous substances (at the establishment or elsewhere) that they can neither create a major accident hazard by themselves nor initiate a major accident involving other dangerous substances

4. Classification

   Substances that are defined as dangerous by virtue of their generic classification in Annex I, Part 2, of Council Directive 96/82/EC but that cannot create a major accident hazard and for which therefore the generic classification is inappropriate for this purpose

The next step is to subdivide the installation or plant into subunits and calculate an A number for the subunit. The number A is calculated by

where Q is the quantity of the substance present from a list in Section 2.3.2.1 of the document, O₁–O₃ are factors for process conditions described in Section 2.3.2.2, and G is the limiting quantity as described in Section 2.3.2.3.

The O₁ factor is either 1 or 0.1 depending if the quantity is in process or in storage.

The O₂ factor is defined in the following table:

And the O₃ factor is dependent upon process conditions as follows:

X = 4.5 × saturation pressure (bar) − 3.5, and P_i is the partial pressure (bar) at the operating or processing temperature.

Δ is for liquids and is dependent upon boiling point of the liquid given below:

Finally, the limit value G is based upon the toxicity of the materials as shown below:

With the additional caveat that flammable substances should not exceed a G value of 10,000 kg and explosive substances equal to or less than 1000 kg of TNT equivalent.

The A numbers are summed for different processes, toxics, explosives, and flammable substances, and then a screening number is developed at eight different locations around the perimeter of the facility. The screening number is of the form

where N is 2 for toxics and N is 3 for flammables and explosives. L is the distance from the installation to the specific location in meters, with a minimum value of L = 100. The selection number has to be calculated for every installation at a minimum of eight locations on the boundary of the establishment, with a minimum distance of 50 m between each selection point. If the establishment has a boundary on the water, then the S value must be calculated on the bank side opposite the establishment.

Sample outline for emergency response

Based upon our combined long experience in dealing with security and incidents, we have prepared an outline for an emergency response plan that should address many of the concerns of the regulatory agencies and should be highly useful to plant and security personnel (Table 7.5).

General note: When discussing the plant and improvements, it is imperative that only activities that are currently implemented are mentioned. Too many times, we have seen the idea that the preparation of the emergency plan, spill plan, or other document is a way of training the new engineer or employee. As a consequence, that employee will often make comments about what should be in place to improve plant performance in a particular area. Often, those improvements are not implemented, and the “hungry” regulator who is looking for reasons to fault the plant can seize upon the “incriminating promise” statements as proof that the plant is lax in the area of protection of its employees, the surrounding population, or the environment, especially if the problem or emergency was in one of the areas where “promised improvements” were never installed.